CRI-O v1.21.8

The release notes have been generated for the commit range v1.21.7…c6f2f1e on Tue, 17 Jan 2023 16:06:03 UTC.

Downloads

Download one of our static release bundles via our Google Cloud Bucket:

CRI-O now logs the stage of container or pod creation under system load. This allows users to find why their creation requests are stalling. (#6346, @haircommander)

Fix a bug where ExecSync requests (exec probes) could use an arbitrary amount of memory and disk. Output from ExecSync requests is now limited to 16MB (the amount that exec output was limited to in the dockershim). Disk limiting requires conmon 2.1.2 to work. See https://github.com/cri-o/cri-o/security/advisories/GHSA-fcm2-6c3h-pg6j and CVE-2022-1708 for more information. (#5950, @haircommander)
Fixed bug to restore /var/lib/containers/storage/overlay/backingFsBlockDev on XFS file systems. (#6424, @saschagrunert)

Avoid a deadlock while moving conmon to a different system scope (RHBZ#2082344) (#5914, @kolyshkin)
Fix a bug where CRI-O would leak a log file if a container failed to be created and the pod hadn’t yet been cleaned up. (#5897, @openshift-cherrypick-robot)
Fix a bug where child processes of containers in the host’s PID namespace appear to leak after the child exits (#5989, @openshift-cherrypick-robot)
Use default umask 0o022 if CRI-O runs under a different umask value. (#6039, @openshift-cherrypick-robot)

Nothing has changed.